A Agra startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If a startup in Agra leaked customer data on an open server, both the company and individuals involved may face liability under Indian law, particularly under the Information Technology Act, 2000, and the Personal Data Protection Bill, 2019 (still pending enactment). Your liability will depend on your role and actions related to the data breach.

Here are key points regarding potential liability:

• Company's Responsibility: Under Section 43A of the Information Technology Act, 2000, if a body corporate fails to implement reasonable security practices and procedures, it can be held liable for compensation to affected individuals.
• Employee Liability: As an employee, your liability may depend on whether you directly contributed to the breach, such as negligence in handling sensitive data. If you followed company protocols, liability may primarily rest with the employer.
• Data Protection Principles: The Personal Data Protection Bill emphasizes the need for data fiduciaries (the company) to ensure data protection and privacy of personal data. Failure to comply may attract penalties.

In response to the data breach, the company should take the following steps:

• Notify Affected Customers: Inform customers whose data was compromised, as per the principles of transparency and accountability outlined in data protection laws.
• Report to Authorities: Under Section 70B of the IT Act, the company should notify the Indian Computer Emergency Response Team (CERT-In) about the data breach, especially if it poses a significant risk to individuals.
• Conduct an Internal Investigation: Assess how the breach occurred and identify vulnerabilities in the existing data security framework.
• Implement Security Measures: Strengthen security protocols, including encryption, access controls, and regular audits to prevent future breaches.
• Legal Consultation: Seek legal advice to understand potential liabilities and compliance with current laws, including the upcoming Personal Data Protection Bill.

In conclusion, while you may have some liability depending on your actions, the primary responsibility lies with the company for ensuring data protection. Immediate remedial action is crucial to mitigate risks and protect customers' data.